Chronos-DFIR integrates offline detection engines that evaluate forensic data against Sigma and YARA rules during ingestion. All detection happens locally — no internet connection required.
Sigma is a generic signature format for SIEM systems, developed by Florian Roth and the SigmaHQ community. It allows analysts to write detection logic once and convert it to multiple query languages (Splunk, Elastic, QRadar, etc.).Chronos-DFIR implements a native Sigma engine (engine/sigma_engine.py) that compiles YAML rules directly to Polars expressions for evaluation against forensic DataFrames.
On startup, Chronos loads all .yml and .yaml files from rules/sigma/ directory tree.Implementation (engine/sigma_engine.py line 40):
def load_sigma_rules(rules_dir=None, force_reload=False): base = rules_dir or "rules/sigma" rules = [] for path in glob.glob(f"{base}/**/*.yml", recursive=True): with open(path, 'r') as fh: doc = yaml.safe_load(fh) rules.append(doc) return rules
Result: 86+ rules cached in-memory for fast evaluation
2
Detection Compilation
Each Sigma rule’s detection block is compiled to Polars expressions.Example rule: rules/sigma/mitre/ta0002_execution/T1059_001_powershell_encoded.yml
title: Human-readable detection nameid: unique-uuid-for-rulestatus: stable | experimental | deprecateddescription: | Multi-line explanation of what this detects, why it matters, and what actions it indicates.references: - https://attack.mitre.org/techniques/T1234/ - Link to blog posts, documentation, etc.author: Your Name / Organizationdate: 2024/03/08tags: - attack.tactic_name - attack.t1234 - attack.sub_techniquelogsource: product: windows | linux | macos service: security | sysmon | auth category: process_creation | network_connectiondetection: selection_block_name: FieldName: value OtherField|modifier: value_or_list filter_block_name: SafeField: legitimate_value condition: selection_block_name and not filter_block_namefalsepositives: - List of known benign scenarios that may trigger this rulelevel: critical | high | medium | low | informational
Question to answer: What combination of fields indicates malicious activity?Example: Detect PsExec lateral movement
Service creation (Event ID 7045)
Service name matches PsExec pattern (PSEXE*)
Service binary path is *.exe in ADMIN$ share
2
Create Rule File
Navigate to appropriate directory:
cd rules/sigma/mitre/ta0008_lateral_movement/
Create new file:
touch T1021_002_psexec_service_creation.yml
3
Write Rule YAML
title: PsExec Lateral Movement via Service Creationid: 12345678-1234-1234-1234-123456789012status: stabledescription: | Detects PsExec-style lateral movement by identifying service creation events with characteristic naming patterns and paths pointing to ADMIN$ share binaries.references: - https://attack.mitre.org/techniques/T1021/002/ - https://docs.microsoft.com/en-us/sysinternals/downloads/psexecauthor: Your Namedate: 2024/03/08tags: - attack.lateral_movement - attack.t1021.002 - attack.executionlogsource: product: windows service: systemdetection: service_creation: EventID: '7045' psexec_naming: ServiceName|startswith: - 'PSEXE' - 'PAExec' admin_share_path: ImagePath|contains: '\\\\ADMIN$' condition: service_creation and psexec_naming and admin_share_pathfalsepositives: - Legitimate remote administration with PsExec - SCCM or other deployment tools using similar patternslevel: high
4
Test Rule
Restart Chronos-DFIR server (rules loaded on startup):
# Ctrl+C to stoppython app.py
Ingest test data containing PsExec events.Verify:
Sigma_Tag column shows rule title
Forensic Insight modal shows detection under “Sigma Rule Detections”
5
Tune for False Positives
If rule triggers on legitimate activity:Option 1: Add filter block
detection: service_creation: EventID: '7045' psexec_naming: ServiceName|startswith: 'PSEXE' legitimate_deployment: ServiceName: 'PSEXESVC-SCCM' condition: service_creation and psexec_naming and not legitimate_deployment
Option 2: Adjust level
level: medium # Lower from high if FP rate is acceptable
Sigma rules use case-insensitive field lookups with dot-notation fallback (engine/sigma_engine.py line 84):
def _field_expr(col_name: str, columns: list[str]): # Exact match first for c in columns: if c.lower() == col_name.lower(): return pl.col(c) # Dot-notation fallback: "EventData.CommandLine" → "CommandLine" last_part = col_name.rsplit(".", 1)[-1] for c in columns: if c.lower() == last_part.lower(): return pl.col(c) return None # Field not found - rule won't match
Implications:
Rule field Image matches DataFrame column image, IMAGE, or Image
Rule field EventData.CommandLine matches column CommandLine (common in Windows logs)
If field doesn’t exist in data, rule silently skips (no error thrown)
YARA is a pattern-matching tool for identifying malware based on textual or binary patterns. Originally designed for file scanning, Chronos-DFIR applies YARA rules to forensic event fields (CommandLine, file paths, message content).
